CLAIMS 

What is claimed is: 

1 1 . A computerized method for sequencing and reassembling messages from protocol 

2 data units exchanged in a communications channel between two computers, the method 

3 comprising: 

4 creating a protocol flow object to represent each protocol layer used by the 

5 communications channel, each protocol flow object having a circuit element associated 
Q 6 with each transmission direction in the channel; 

CH 7 arranging the protocol flow objects in a logical tree structure that mirrors a 

JO 8 hierarchy for the protocol layers; 

s p 9 creating circuit flow objects for each protocol layer to represent the protocol data 

~ 10 units for the protocol layer immediately higher in the hierarchy; 

jf*5 1 1 associating a transmission direction with each circuit flow object; 

s7a 12 linking each circuit flow object for a protocol layer to the circuit element of the 

13 representative protocol flow object that matches the transmission direction associated 

14 with the circuit flow object; 

15 sequencing the circuit flow objects linked to a particular protocol flow object 

16 when specified by the protocol layer represented by the particular protocol flow object; 

17 and 

18 reassembling the messages from the circuit flow objects linked to the protocol 

19 flow object at the top of the tree structure. 

1 2. The method of claim 1, wherein creating the circuit flow objects for each protocol 

2 layer comprises: 
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3 * creating the circuit flow objects for the protocol flow object at the bottom of the 

4 tree structure by extracting data from the protocol data units for the protocol layer lowest 

5 in the hierarchy; and 

6 creating the circuit flow objects for the remaining protocol flow objects in the tree 

7 structure by extracting data from the circuit flow objects linked to the protocol flow 

8 object immediately lower in the tree structure. 

1 3. The method of claim 1, wherein a circuit flow object comprises a vector list to 

O 2 represent fragmented data. 

't.h 

CO 1 4. The method of claim 3, wherein a vector list comprises a vector specifying a 

S 2 

*E 2 protocol data unit number, a length value, and an offset value for each fragment of the 

in 

s 3 fragmented data. 

U. 

Tfi 1 5. The method of claim 4 further comprising: 

";t 2 reassembling the fragmented data in accordance with the vectors in a vector list. 

1 6. The method of claim 1 wherein the protocol flow objects are created in order from 

2 the bottom to the top of the hierarchy. 

1 7. The method of claim 6, wherein the circuit flow objects for a current protocol 

2 flow object are created before creating the protocol flow object for the protocol layer 

3 immediately above the current protocol flow object in the hierarchy. 

1 8. The method of claim 1 wherein arranging the protocol flow objects into a logical 

2 tree structure comprises: 
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3 creating multiple branches in the tree structure when a plurality of protocol layers 

4 are immediately above a current protocol layer in the hierarchy, each branch 

5 corresponding to one of the plurality of protocol layers. 

1 9. The method of claim 1 further comprising: 

1 determining the protocol layers in the hierarchy. 

1 10. The method of claim 1 further comprising: 
C3 2 storing the protocol flow objects and the circuit flow objects in a flow object 

m 3 database. 

\M 

V 1 11. A computer-readable medium having computer-executable instructions to a cause 

* ! s 2 a computer to perform a method comprising: 

;[* 1 creating a protocol flow object to represent each protocol layer used by a 

H 2 communications channel, each protocol flow object having a circuit element associated 

y 3 with a transmission direction in the channel; 

4 arranging the protocol flow objects in a logical tree structure that mirrors a 

5 hierarchy for the protocol layers; 

6 creating circuit flow objects for each protocol layer to represent the protocol data 

7 units for the protocol layer immediately higher in the hierarchy; 

8 associating a transmission direction with each circuit flow object; 

9 linking each circuit flow object for a protocol layer to the circuit element of the 

10 representative protocol flow object that matches the transmission direction associated 

1 1 with the circuit flow object; 
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12 * sequencing the circuit flow objects linked to a particular protocol flow object 

13 when specified by the protocol layer represented by the particular protocol flow object; 

14 and 

15 reassembling the messages from the circuit flow objects linked to the protocol 

16 flow object at the top of the tree structure. 

1 12. The computer-readable medium of claim 1 1 having further computer-executable 

2 instructions comprising: 

O 3 creating the circuit flow object for the protocol flow object at the bottom of the 

jjpj 4 tree structure by extracting data from the protocol data units for the protocol layer lowest 

%. ii 
-a 

jq 5 in the hierarchy; and 

3*"*' 

c g 6 creating the circuit flow objects for the remaining protocol layers by extracting 

in 

" a 7 data from the circuit flow objects linked to the protocol flow object immediately lower in 

8 the tree structure. 

^ 1 13. The computer-readable medium of claim 1 1 having further computer-executable 

a* a 
»=rr 

2 instructions comprising: 

3 creating a circuit flow object as a vector list to represent fragmented data. 

1 14. The computer-readable medium of claim 13 having further computer-executable 

2 instructions comprising: 

3 creating a vector list from a plurality of vectors, each vector specifying a protocol 

4 data unit number, a length value, and an offset value for a fragment of the fragmented 

5 data. 
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15. The computer-readable medium of claim 14 having further computer-executable 
instructions comprising: 

reassembling the fragmented data in accordance with the vectors in a vector list. 

16. The computer-readable medium of claim 1 1 having further computer-executable 
instructions comprising: 

creating multiple branches in the tree structure when a plurality of protocol layers 
are immediately above a current protocol layer in the hierarchy, each branch 
corresponding to one of the plurality of protocol layers. 

17. The computer-readable medium of claim 1 1 having further computer-executable 
instructions comprising: 

determining the protocol layers in the hierarchy. 

18. The computer-readable medium of claim 1 1 having further computer-readable 
instructions comprising: 

storing the protocol flow objects and the circuit flow objects in a flow object 
database. 

19. A computer-readable medium having stored thereon an protocol flow object data 
structure comprising: 

a key field containing data representing an identifier for a connection between two 
computers at a protocol layer; 

a primary circuit element containing data representing a link to a series of protocol 
data units flowing in one direction in the connection identified by the key field; and 
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7 
8 
9 



' an alternate circuit element containing data representing a link to a series of 
protocol data units flowing in an opposite direction in the connection identified by the 
key field. 



5 Fii 



w 
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1 20. The computer-readable medium of claim 19, wherein the links comprise hash 

2 tables for identifying the series of data units. 

1 21 . A computer-readable medium having stored thereon a re-assembly vector 

2 comprising: 

3 a protocol data unit field containing data representing a number for a protocol data 

4 unit; 

5 a length field containing data representing a length of a data payload in the 

6 protocol data unit identified by the protocol data unit field; and 

7 an offset field containing data representing a starting position of the data payload 

8 in the protocol data unit identified by the protocol data unit field. 

1 22. A computer-readable medium having stored thereon a flow object data structure 

2 comprising: 

3 a plurality of protocol flow objects, each protocol flow object comprising: 

4 a key field containing data representing an identifier for a connection 

5 between two computers at a protocol layer; 

6 a primary circuit element containing data representing a link to a series of 

7 protocol data units flowing in one direction in the connection identified by the key field; 

8 and 
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9 an alternate circuit element containing data representing a link to a series 

10 of protocol data units flowing in an opposite direction in the connection identified by the 

1 1 key field; 

12 a tree structure comprising a plurality of entries, each entry comprising: 

13 a protocol field containing data representing the identifier for one of the 

14 plurality of protocol flow objects; 

15 a lower protocol field containing data representing the identifier for the 

16 protocol flow object immediately lower in a protocol layer hierarchy relative to the 
'% 17 protocol flow object identified by the protocol field; and 

J ? ! 1 8 a higher protocol field containing data representing the identifier for the 

J-y 19 protocol flow object immediately higher in the protocol layer hierarchy relative to the 

*F 20 protocol flow object identified by the protocol field. 

In 

□ 1 23. The computer-readable medium of claim 22 further comprising: 

y 2 a plurality of circuit flow objects, each circuit flow object containing data 

q 3 representing one of the protocol data units. 

1 24. A computerized system comprising: 

2 a processor; 

3 a memory coupled to the processor through a bus; 

4 a computer-readable medium coupled to the processor through the bus; 

5 a plurality of protocol interpreters stored on the computer-readable medium for 

6 execution by the processor; and 

7 a decode engine executed from the computer-readable medium to cause the 

8 processor to 
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9 - create protocol flow objects representing protocol layers and circuit flow objects 

10 representing data flows at the protocol layers, 

1 1 extract data from the circuit flow objects representing protocol data units at a 

12 particular protocol layer as directed by one of the protocol interpreters, 

13 sequence the circuit flow objects representing the protocol data units at a 

14 particular protocol layer if directed by one of the protocol interpreters, and 

15 reassemble messages from the circuit flow objects representing the protocol data 

16 units at a particular protocol layer if directed by one of the protocol interpreters. 

in 1 25. The computer system of claim 24, wherein the decode engine further causes the 

M 

|£f 2 processor to store the protocol flow objects and circuit flow objects in a flow database, 

3 C 3 logically link the protocol flow objects into a hierarchical tree structure, and to logically 

g 4 link the circuit flow objects to the protocol flow objects. 

if™ 1 

H 1 26. The computer system of claim 24, wherein the decode engine further causes the 

2 processor to create a circuit flow object as a vector list to represent fragmented data. 

1 27. The computer system of claim 26, wherein the decode engine further causes the 

2 processor to create a vector list from a plurality of vectors, each vector specifying a 

3 protocol data unit number, a length value, and an offset value for a fragment of the 

4 fragmented data. 

1 28. The computer system of claim 27, wherein the decode engine further causes the 

2 processor to reassemble the fragmented data in accordance with the vectors in a vector 

3 list. 
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1 29. A method of communicating between a protocol interpreter and a segmentation 

2 and re-assembly decode engine for a communications network comprising: 

3 issuing, by the protocol interpreter, an add data unit command; 

4 receiving, by the segmentation and re-assembly decode engine, the add data unit 

5 command; and 

6 issuing, by the segmentation and re-assembly decode engine in response to 

7 receiving the add data unit command, an instruction to a flow object data base. 

in 

^ 1 30. The method of claim 29, wherein the instruction is selected from the group 

fp& 

1*1 2 consisting of adding a circuit flow object to the flow object data base, associating a circuit 

- 3 flow object to a protocol flow object in the flow object data base, retrieving a circuit flow 

s ™ 4 object from the flow object data base, and sequencing a circuit flow object relative to 

if 3 

3 5 other circuit flow objects in the data base. 

p 

if 

w 
O 
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